Bug 1768391: Invalidate the remote HyperText offsets cache when we mutate the tree. r=eeejay

Previously, we invalidated this cache when the reorder event arrived.
Because the mutation and the reorder event happen in separate IPDL calls, it's possible for a client call to arrive between them.
If that client call queried HyperText offsets, this could result in returning incorrect information to the client or even a parent process crash.
Now, we invalidate the cache during the mutation, so there's no possibility of an intervening client call.
It made sense to put this invalidation call in RemoteAccessibleBase, so I also moved the call to invalidate for text leaf updates into RemoteAccessibleBase so that they're both in the same class.

Differential Revision: https://phabricator.services.mozilla.com/D145845

accessible/ipc/DocAccessibleParent.cpp

@@ -296,10 +296,6 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvEvent(
   if (StaticPrefs::accessibility_cache_enabled_AtStartup()) {
     if (aEventType == nsIAccessibleEvent::EVENT_REORDER ||
         aEventType == nsIAccessibleEvent::EVENT_INNER_REORDER) {
-      if (proxy->IsHyperText()) {
-        // Invalidate the HyperText offset cache.
-        proxy->InvalidateCachedHyperTextOffsets();
-      }
       for (RemoteAccessible* child = proxy->RemoteFirstChild(); child;
            child = child->RemoteNextSibling()) {
         child->InvalidateGroupInfo();
@@ -578,13 +574,6 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvCache(
     }
 
     remote->ApplyCache(aUpdateType, entry.Fields());
-    if (aUpdateType == CacheUpdateType::Update && remote->IsTextLeaf()) {
-      // Invalidate the HyperText offset cache.
-      RemoteAccessible* parent = remote->RemoteParent();
-      if (parent && parent->IsHyperText()) {
-        parent->InvalidateCachedHyperTextOffsets();
-      }
-    }
   }
 
   if (nsCOMPtr<nsIObserverService> obsService =

accessible/ipc/RemoteAccessibleBase.h

@@ -35,6 +35,9 @@ class RemoteAccessibleBase : public Accessible, public HyperTextAccessibleBase {
 
   void AddChildAt(uint32_t aIdx, Derived* aChild) {
     mChildren.InsertElementAt(aIdx, aChild);
+    if (IsHyperText()) {
+      InvalidateCachedHyperTextOffsets();
+    }
   }
 
   virtual uint32_t ChildCount() const override { return mChildren.Length(); }
@@ -114,7 +117,12 @@ class RemoteAccessibleBase : public Accessible, public HyperTextAccessibleBase {
   /**
    * Remove The given child.
    */
-  void RemoveChild(Derived* aChild) { mChildren.RemoveElement(aChild); }
+  void RemoveChild(Derived* aChild) {
+    mChildren.RemoveElement(aChild);
+    if (IsHyperText()) {
+      InvalidateCachedHyperTextOffsets();
+    }
+  }
 
   /**
    * Return the proxy for the parent of the wrapped accessible.
@@ -245,6 +253,12 @@ class RemoteAccessibleBase : public Accessible, public HyperTextAccessibleBase {
         mCachedFields = new AccAttributes();
       }
       mCachedFields->Update(aFields);
+      if (IsTextLeaf()) {
+        Derived* parent = RemoteParent();
+        if (parent && parent->IsHyperText()) {
+          parent->InvalidateCachedHyperTextOffsets();
+        }
+      }
     }
   }